RE: [gnso-ff-pdp-may08] Mannheim formula reference

[Joe St Sauver <joe@xxxxxxxxxxxxxxxxxx>]

Hi Marika,

#As discussed on our call yesterday, please find below the original 
#proposal regarding the inclusion of the Mannheim formula in the report. 
#At that time, the proposed text was not accepted. 

This may have been handled during one of the calls I couldn't make because
of travel, but for the final report is the included text now reduced to 
solely that which has agreement or substantial agreement? In other words, 
is the text associated with alternative positions or positions which have 
only limited support now gone? 

#Joe, as you provided the original text, and Rod, as you proposed to include 
#a reference in the final report, could you maybe work together on a new 
#text and proposed place in the document and circulate it to the group for 
#consideration? Greg provided a link to the paper in an earlier email 
#( http://pi1.informatik.uni-mannheim.de/filepool/research/publications/fa
#  st-flux-ndss08.pdf), so maybe he is interested in participating in this 
#effort too?

For:

#The majority of members of the working group believe that the Mannheim 
#fast flux score formula would provide a robust and mechanically applicable 
#definition of "fast flux" which would minimize false positives, and 
#believe that the use of whitelisting plus manual review can eliminate 
#any remaining potential false positives.

how about:

  The Mannheim fast flux scoring formula provies a robust and mechanically 
  applicable definition of "fast flux," and whitelisting plus manual review
  can manage the risk of "false positive" fast flux determinations.

Regarding the next paragraph:

#The working group received multiple offers of fast flux-related data from 
#<insert list of fastflux data sources here [I'm aware of at least two or 
#three, but I'll defer to the data collection subcommittee for a definitive 
#list]>. The working group accepted [or rejected] data from those sources, 
#and [did what with it?], finding [what?]. Those interested in working 
#with that data can apply to obtain access to it by contacting [who?]

How about:

  The working group received fast flux-related data from Arbor Networks 
  and from Karmasphere. The analysis of that data can be found in the
  Appendix to this report. Those interested in requesting access to that 
  data should contact <insert address from arbor.net and karmasphere here>

The last paragraph, below, doesn't appear to be related to the Manheim 
formula, so in that context, I'll refrain from commenting on it.

#While it may not be possible to definitively distinguish the costs of 
#cybercrime associated with fast flux from the costs of cybercrime 
#conducted separate from fast flux, the working group did receive reports 
#on aggregate estimates of cybercrime-related costs, and even if a 
#fraction of 1% of all cybercrime can be tied to fast flux, the costs 
#would be staggering. Moreover, at least in some cases such as the use 
#of fast flux to distribute child pornography, there are substantial 
#non-financial human costs which should also be recognized.

Regards,

Joe